CVE-2026-109090
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In libXi before 1.8.4, a malicious X server can cause a heap overflow by injecting a large DEVICE_ENABLE reply. This may lead to a crash or potential code execution.
Risk Assessment
An attacker controlling an X server could exploit this to cause a heap overflow, potentially resulting in denial of service or code execution in the client application context. The risk affects systems connecting to untrusted X servers.
Recommendation
Update libXi to version 1.8.4 or later. Also avoid connecting to untrusted X servers.
Other vulnerabilities in libXi
See all- CVE-2016-7946High
LibXi versions before 1.7.7 allow remote X servers to cause a denial of service via an infinite loop involving length fields.
- CVE-2026-109089High
A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.
- CVE-2026-94282Medium
An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion before 1.8.4 could be used by malicious X server to crash an attached X client.
- CVE-2026-94281Medium
An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93545Medium
An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93544Medium
An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
- CVE-2026-93543High
An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
- CVE-2026-93542Medium
An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicious servers to crash the X client.
- CVE-2026-93541Medium
An out-of-bounds read in libXi's XQueryDeviceState() before version 1.8.4 could be exploited by an attacker. The description is incomplete, but the vulnerability may lead to information disclosure or a crash.
Original NVD description (English source)
A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS